The Wire.AI Security News and Incident Tracker

Threat · curated 17 Sep 2026

New RatHat Android malware uses AI to automate device control

First reported bleepingcomputer.com

Dossier

Coverage timeline

17 Sep 2026bleepingcomputer.com

Single-source incident — first reported, latest, and curated coincide.

Why it matters

RatHat shows attackers weaponizing an LLM to make on-device automation adaptive and harder for security software to detect, marking a shift from fixed-script Android malware toward AI-driven remote device control.

RatHat is a newly discovered Android malware, analyzed by Zimperium zLabs and linked to China-based actors, that uses an AI-powered UI-automation engine to remotely navigate compromised devices. The malware serializes the live Android Accessibility tree into XML and sends it to an AI assistant, which returns element coordinates, on-screen text, and navigation instructions (e.g., SCROLL_DOWN), enabling adaptive remote control alongside ADB shell access, keylogging, HTML banking overlays, SMS/OTP interception, and persistence.

campaign

Summary

RatHat is a newly discovered Android malware analyzed by Zimperium zLabs that pairs traditional Accessibility-abuse banking-trojan capabilities with an AI-powered automation engine used to remotely navigate and control infected devices. Researchers attribute it to China-based threat actors based on LLM prompts written in Chinese.[0]

The malware is distributed outside Google Play via malvertising, SMS, and phishing sites, and after installation abuses Accessibility permissions to enable Developer Options and Wireless Debugging, obtaining a local ADB shell that it uses to deploy Go-based agents for command execution, reverse-proxy tunneling, credential theft via overlays, and resilient persistence.[0]

Attack chain

  1. Distribution: RatHat is spread through malvertising, SMS, and phishing sites promoting APK downloads from outside the Google Play store.[0]
  2. Privilege escalation via Accessibility: The malware abuses Android Accessibility permissions to perform highly privileged actions, including enabling Developer Options and Wireless Debugging.[0]
  3. Local shell (ADB) access: Using Wireless Debugging, RatHat gains a local shell-level ADB execution context without needing an external computer.[0]
  4. Agent deployment and persistence: ADB access installs a Go-based agent (liblocal-service.so) that runs commands with ADB shell privileges, bypasses battery restrictions, manages persistence, and restores the malware if removed; the malware likewise restores the agent.[0]
  5. Reverse-proxy tunneling: A second agent (libmedia_codec.so) acts as an FRP reverse-proxy client, establishing a persistent tunnel back to the attacker.[0]
  6. Credential and data theft: RatHat shows HTML overlays for targeted banking and cryptocurrency apps, intercepts SMS/notifications/OTPs, records text-change events, extracts browser URLs, and captures lock-screen PINs, passwords, and unlock patterns.[0]
  7. AI-guided device control: RatHat serializes the live Accessibility tree into XML and sends it to an unnamed AI assistant to identify element coordinates, read on-screen text, and return navigation commands such as SCROLL_DOWN, enabling adaptive remote navigation.[0]
  8. Anti-removal and anti-analysis: RatHat intercepts the uninstall confirmation screen, cancels it, and shows a fake Google Play error overlay; it also uses APK container tampering, a bloated 61MB manifest, and invalid DEX pseudo instructions to hinder analysis.[0]

Disclosure timeline

DateEvent
September 17, 2026BleepingComputer reports Zimperium zLabs' discovery and analysis of the RatHat Android malware.[0]

How it works

RatHat does not exploit a software vulnerability but abuses legitimate Android features: after tricking users into granting Accessibility permissions, it programmatically enables Developer Options and Wireless Debugging to obtain a local ADB shell context on-device, then uses that shell to install Go-based native agents (liblocal-service.so and libmedia_codec.so) for command execution, FRP reverse-proxy tunneling, and mutual-restore persistence.[0]

Its distinguishing mechanic is AI-driven UI automation: the malware serializes the live Accessibility tree to XML and queries an unnamed AI assistant to locate element center coordinates, resolve on-screen text, and return navigation actions, making automation more adaptable than fixed scripts and harder for security software to detect.[0]

Indicators of Compromise

TypeIndicatorContext
file-pathliblocal-service.soGo-based agent installed via ADB that runs shell-privileged commands, bypasses battery restrictions, and provides mutual-restore persistence.[0]
file-pathlibmedia_codec.soSecond agent acting as an FRP reverse-proxy client establishing a persistent tunnel to the attacker.[0]

Key takeaways

  • RatHat demonstrates malware operators integrating an external AI assistant into on-device UI automation, allowing adaptive remote navigation without real-time operator interaction and complicating detection.[0]
  • By enabling Developer Options and Wireless Debugging to reach a local ADB shell, RatHat achieves computer-independent, resilient control and persistence, a pattern also seen in ToxicPanda and RedHook Android families.[0]

Defensive actions

  • Do not install APK files from outside Google Play unless the publisher is explicitly trusted.: RatHat is distributed via malvertising, SMS, and phishing sites promoting off-store APK downloads.[0]
  • Avoid granting Accessibility permissions to apps.: RatHat relies on Accessibility permissions to perform privileged actions, enable Wireless Debugging, and drive on-device automation.[0]
  • Regularly scan devices with Google Play Protect.: Play Protect scanning is recommended to detect malware like RatHat on Android devices.[0]